AUTH ARMOR · CVE-2026-110960 · Package
NO FIX YET
The Auth Armor WordPress plugin through version 1.0.3 has handlers that do not require login, so anyone on the internet can use them. An attacker can read the site's stored API credentials and reset an administrator's enrollment to take over that admin account.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any WordPress site running the Auth Armor plugin through 1.0.3 is exposed, because its handlers answer logged-out visitors. Sites that do not have the plugin installed are not affected. The sources do not say whether a non-default setting is needed.
Not affected if plugin-not-installed
Who cares auth-armor, self-hosted, wordpress
1.0.3 or lower, in the WordPress admin under Plugins or in the wp-content/plugins/ folder.readme.txt or main file header for the Version: line.Unknown from the sources.
The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.